stock here: This is Goodbye Time. I tried Zelle and it was fast and easy. This is bank based, not third party charlatans.
Paypal is requiring complete access to my primary checking account. They want to be able to log in, check balances, check entire history, and they specifically mention that they will have access to any medical or health payments and details.
This is bat shit crazy. Terms below
https://www.finicity.com/terms-privacy/en-US/#termsofuse
Your reaction is justified. This is apparently a legitimate PayPal/Mastercard process, but it is asking for a very high level of access. It is not merely confirming the routing and account numbers.
PayPal’s own documentation says its instant-confirmation option requires entering your online-banking login details through a third-party provider. That provider may then check your account balance and transaction information when PayPal considers it necessary. Mastercard describes Data Connect as an open-banking system through which customers log in and authorize selected account data to be shared.
My recommendation
Do not use this “upgrade” unless PayPal is forcing you to and you truly need that bank connected. The existing connection appears to be working, and the supposed benefits mainly accrue to PayPal: fewer failed ACH transactions, balance monitoring, account verification and fraud control.
Use the safer manual method instead:
- Close this page.
- Open a fresh browser tab and type
paypal.comyourself. - Sign in and go to Wallet → Bank Five Nine.
- Look for “Link your bank another way,” “Confirm another way,” or manual verification.
- Use the two-small-deposit method rather than providing bank credentials.
PayPal expressly says the manual alternative is available: it sends two small deposits, which you later verify.
Important distinction
A properly implemented connection may redirect you to Bank Five Nine’s own authenticated website, where the bank handles the password and issues an authorization token. That is much better than entering your password into a PayPal- or Mastercard-branded form. Mastercard calls this an OAuth connection.
Before entering anything, inspect the address bar:
- The login page should ultimately be on the bank’s genuine domain.
- Do not trust the PayPal logo or the bank name displayed inside the page.
- Do not proceed from a link in an email or text.
- A long encoded
?flow=...address is not itself proof of fraud, but the screenshot cuts off the actual domain, so the page cannot be authenticated from the image alone.
Bottom line: probably not phishing if you initiated it inside PayPal, but it is intrusive open-banking authorization. I would decline it and retain the present ACH connection or use microdeposit verification.
Pasted text(21).txt
Document
they seem to be forcing me to give them full credentials, review this also
Yes. The terms confirm that they may require your actual bank credentials—not merely an authorization token. Your concern is accurate.
The agreement defines “Credentials” to include access numbers, passwords, security-question answers, account numbers, and other login information. It explicitly says you may have to provide those credentials directly to Finicity/Mastercard Data Connect.
More importantly, clicking Next authorizes Finicity to:
- use those credentials to access your bank accounts;
- retrieve and analyze your financial data;
- deliver that data to PayPal;
- act as your “attorney-in-fact and agent,” with substitution rights, to access third-party systems and perform whatever lawful steps are necessary to retrieve and disclose the data.
That is exceptionally broad language.
What they may collect
The privacy notice says authentication data can include:
- username and password;
- security questions and answers;
- PINs;
- multifactor-authentication responses;
- security tokens.
The financial-data access is also broader than confirming that the account exists. It may include balances, complete transaction history, account-owner information, loans, investments, income, payroll, tax-related information and transaction descriptions.
They may use this data to infer such things as your income, employment, cash flow, recurring payments and likelihood of making a payment on a particular day.
The agreement even warns that transaction records may reveal medical information and authorizes sharing that information with the recipient for a legal purpose connected to the requested service.
The credentials issue is not just theoretical
The terms distinguish between two connection methods:
- Access using an authenticated token, typically through the bank’s own OAuth login.
- Access through a “set of credentials,” meaning the aggregator receives or uses the login information.
The privacy notice expressly says it may access accounts through either method.
Therefore, unless the next screen clearly redirects you to Bank Five Nine’s genuine website, where the bank itself authenticates you and displays a defined permission screen, you should assume Finicity is requesting credentials that it can use to log into the account on your behalf.
Their liability terms are also one-sided
The contract says use is at your sole risk, disclaims warranties that the service will be secure or error-free, and attempts to disclaim responsibility for losses and damages.
It also requires individual arbitration and waives jury and class-action rights unless you mail an arbitration rejection within 60 days after agreeing.
You can revoke consent, but the agreement says they receive a “reasonable period of time” to process that revocation. Their retention provision does not promise immediate deletion; it says retention depends on business needs, possible reenrollment, legal requirements and limitation periods.
Are they truly forcing it?
PayPal’s own current help page says users who do not want to enter bank-login details should be able to choose “Link your bank another way” and confirm using two microdeposits.
However, PayPal may be forcing this newer connection for a particular existing account, transfer type, risk review or feature. The screen you showed is framed as an “upgrade,” but it may effectively become mandatory if PayPal disables the old connection or refuses certain transfers without the upgrade.
My assessment
I would not accept this merely for faster PayPal transfers. It is legitimate open-banking software, not necessarily a scam, but the permissions are materially broader than the screen’s friendly language suggests.
My practical approach would be:
- Cancel the Data Connect flow.
- Return directly to PayPal’s Wallet—not through an email link.
- Look for Link your bank another way or manual account entry.
- Try removing and relinking the bank manually using routing and account numbers.
- Use a credit card, debit card or a separate low-balance checking account for PayPal if manual verification is unavailable.
- Ask Bank Five Nine whether it supports a genuine OAuth/token connection to PayPal. A bank-hosted authorization page is preferable to giving Finicity reusable credentials.
I would especially avoid connecting your primary personal or business operating account. A dedicated PayPal transfer account containing only limited working funds sharply reduces both privacy exposure and potential loss.